ie8 fix
madison

Zero Day

Ryan Naraine, Emil Protalinski and Dancho Danchev

New Mac OS X malware variant spotted

By | April 16, 2010, 11:40am PDT

Summary: According to Intego’s security memo, OSX/HellRTS.D is being distributed on a number of forums shows that it will be accessible to a large number of malicious users who may attempt to use it to attack Macs.

Intego is reporting on a newly discovered variant of a Mac OS X malware first detected in 2004.

According to the company, the source code of the OSX/HellRTS.D is already being distributed across multiple forums, which could potentially allow malicious attackers to create new variants of it.

More details on the malware:

  • It sets up its own server and configures a server port and password
  • It duplicates itself, using the names of different applications, adding the new version to a user’s login items, to ensure that it starts up at login. (These different names can make it hard to detect, not only in login items, but also in Activity Monitor.)
  • It can send e-mail with its own mail server, contact a remote server, and provide direct access to an infected Mac
  • It can also perform a number of operations such as providing remote screen-sharing access, shutting down or restarting a Mac, accessing an infected Mac’s clipboard, and much more

According to the brief security memo, OSX/HellRTS.D “is being distributed on a number of forums shows that it will be accessible to a large number of malicious users who may attempt to use it to attack Macs.

A similar leak of source code took place in November, 2009, when the source code for ikee iPhone worm became publicly available. The leak, however, didn’t result in any new worm modifications back then.

The company has rated the malware as low risk due to the fact that they are unaware of any infected Macs so far.

However, this rating shouldn’t apply to you overall situational awareness (See: How To Disable “Open Safe Files After Downloading” Feature In Safari) on the fact that Mac OS X malware is no longer an urban legend, but a fully realistic event with Apple Inc. publicly admitting that “no system can be 100 percent immune from every threat“.

Kick off your day with ZDNet's daily e-mail newsletter. It's the freshest tech news and opinion, served hot. Get it.

Topics

Dancho Danchev is an independent security consultant and cyber threats analyst, with extensive experience in open source intelligence gathering, malware and cybercrime incident response.

Disclosure

Dancho Danchev

More details on Dancho Danchev's current and past professional affiliations, can be found in his LinkedIn profile.

Biography

Dancho Danchev

Dancho Danchev is an independent security consultant and cyber threats analyst, with extensive experience in open source intelligence gathering, and cybercrime incident response. He's been an active security blogger since 2007, and maintains a popular security blog sharing real-time threats intelligence data with the rest of the community on a daily basis. More details on Dancho Danchev's current and past professional affiliations, can be found in his LinkedIn profile. You can also follow him on Twitter
92
Comments

Join the conversation!

Just In

RE: New Mac OS X malware variant spotted
efsane Updated - 9th Apr 2011
Great!!! thanks for sharing this information to us!
sesli sohbet sesli chat
0 Votes
+ -
Cue the neverending crapfest..
daftkey Updated - 16th Apr 2010
In fact I'll sum it up for you...

"This shows all the Appletards that OSX CAN get viruses!" - WinTard

"No idiot apple Shill, it's a malicious file, not a virus in the wild, Macs don't get viruses!" - AppleTard

"This wouldn't happen with Open-Source because all the code is transparent" - Linux Tard
0 Votes
+ -
Wow, one item this year!
GoPower 16th Apr 2010
Sure makes me feel unsafe, not! Are you related to Homer, Doh!
0 Votes
+ -
Oh my!
gtdworak 18th Apr 2010
Makes me want to get rid of all my Macs and run out and get one of those
there Winders computers. How many viruses and pieces of malware on them
Winders machines? I take take it a lot less then them Apple puters. I trust
Steve Ballmer, he would never allow such a thing on one of them Dell's or
whatever brand to be vulnerable to such a thing. That would be unethical.
Besides, who would trust a system from that dag hippy running Apple.
0 Votes
+ -
....
Badgered 19th Apr 2010
Wow, one item this year! Sure makes me feel unsafe, not!

You're absolutely right... there's nothing to worry about. OS X is the most secure OS on the planet... or not...

http://www.tomshardware.com/news/security-hacker-os-x-windows-7-flash,10205.html
0 Votes
+ -
As a viral writer, why would you bother??
kaninelupus 21st Apr 2010
Targeting Windows (note malware almost needs to target specific variants these days), you hit a multitude of schools, businesses, general users, etc.

Target Linux and you hit a multitude of Servers, businesses looking for less cost and more control, or a user-pool well equipped to fight back.

Target Macs and you aim at a few Ad agencies, Magazines and a user-pool of Gen-Y'ers prattling on about how pretty their toys look (that's when you can pry them away from the mirror!). Let's face it; even if a TEAM of skilled malware writers got together and wrote a sophisticated code targeted at Macs, the majority of the users would be too distracted by their own reflection in the blank screens to even notice!!

It wouldn't be worth the effort!
0 Votes
+ -
You're completely right.
AzuMao 21st Apr 2010
There couldn't be any financial gain in hacking the largest bank in the entire
world.

And nobody would be curious in hacking the largest particle accelerator in the
world, or NASA's satellites. No no no.

And definitely not the top 10 supercomputers in the world. What fun would that
be?

It's obviously much more fun and profitable to hack Joe Sixpack's Dell so you
can steal the free porn he downloaded on Kazaa.

That logic totally makes sense, yep.
0 Votes
+ -
Yep.. That's about it... except
Wolfie2K3 16th Apr 2010
... on here they're called Mactards and Lintards.

But... Yeah.. that's pretty much right on the money. And somehow I think the Mac guy would likely say something more along the lines of "No, idiot Windoze (or M$) shill..." Somehow I doubt they'd be insulting their own. They'd also add something to the effect of "Show me ONE infection anywhere in the wild!" and eventually close their specious argument with "Nothing to see here, no worries!" or some variation of that.

The Lintard bit - that's classic Dietrich...! Spot on!
0 Votes
+ -
RE:Cue the neverending crapfest..
richdave 19th Apr 2010
58 comments thus far and none by a "lintard"! Curious, no?
0 Votes
+ -
but... but... but... OSX is immune to viruses and malware!

/sarcasm off
0 Votes
+ -
tell his readers just what steps an OSX user would have to
go thru in order for his system to be infected by a
particular malware code - in this case, the OSXHellRTS.D

Its one thing to report that a particular software code is a
virus or trojan or whatever. Its another matter to report
how it is propagated.

If this worm is classified as "low risk" than why is it "low
risk". If the answer is that no known OSX systems have
been infected so far than the most important question to
ask (or have answered) is why not? What prevents an OSX
system from being infected by this worm? Or easily
infected by this worm.

These are questions I wish Dancho would answer .. Just
once.
0 Votes
+ -
Isn't it obvious?
hill60 16th Apr 2010
It's probably got something to do with buying software off the company
that is reporting this malware, I'm sure they offer a solution.

Not downloading cracked and pirated software would be a good start.
..source, compile it, mark it as executable, run it, and type in your root admin password.


As opposed to the recent flaws in IE where simply browsing the web = pwnt.
So that pretty much kills your entire argument.
0 Votes
+ -
Well then..
ShadowGIATL 17th Apr 2010
you have a lack of understanding of what a worm is then.

And much like Windows worms, only those that surf shady sites, and accept unknown files from others are really at risk.

This notion that one must compile the worm themselves is completely false, as a worm spreads itself by definition. If it doesn't, then it is not a worm.
0 Votes
+ -
You're thinking of trojans.


Back on topic; seeing as how the malware mentioned in the article isn't known
to exist anywhere except as source code, it's going to be tricky infecting
yourself with it without first compiling it.
0 Votes
+ -
Trojans don't spread themselves...
ShadowGIATL 17th Apr 2010
trojans are only backdoor programs. The trojan is usually downloaded by a worm or virus.

Your only digging yourself deeper here... give up while your not to far behind.
  • Flagged
0 Votes
+ -
@ShadowGIATL If you need to download and run it, it isn't running itself.

Exactly. So by definition, what you described is NOT a worm. It is source code. Not sure where you're going with this.
  • Flagged
0 Votes
+ -
NT
0 Votes
+ -
Proof of what?
ShadowGIATL 19th Apr 2010
Of what a worm is?

If you can't look up info on what a worm is, then I'm afraid providing you a link won't do you much good. Troll elsewhere.
0 Votes
+ -
Well then..
you have a lack of understanding of what a worm is then.

And much like Windows worms, only those that surf shady sites, and accept unknown files from others are really at risk.


That if the only way you can get it is to download and run some executable from a shady website/stranger that it's a worm, not a trojan.

Please keep in mind that repeatedly stating it as fact and posting random personal insults won't prove it.
is not a personal attack.

I don't need a link, because the definitions of what a worm is is generally universally known in the computer world. Sorry if you missed the memo.

If your asking for a link about how worms travel from site to site, and system to system, then do a web search. It's not that hard.

It is not a matter that is under debate, as the definitions of trojans, and worms have been in place for quite some time now.
0 Votes
+ -
And?
AzuMao 20th Apr 2010
Stating that you aren't following along with what I'm saying..
is not a personal attack.


Saying anyone who disagrees with you is retarded/has their head up someone's ass/is brainwashed/etc is.

I don't need a link, because the definitions of what a worm is is generally universally known in the computer world. Sorry if you missed the memo.

The universally known definition contradicts yours.
What you've described is actually a trojan.
  • Flagged
Reading the story is proof of that.
0 Votes
+ -
Agreed
Jeremy-UK 17th Apr 2010
What's really required here is a simple "how does this work?" Followed
by "how do I protect my system?" What do we get? "Wooo! Mac
Malware! Wooo!"

If ZDnet wants to be taken seriously, then help users make informed
choices. Answer the questions, "How does a Mac get this?" and "How
do I prevent my Mac from getting this?".

As ZDnet aren't going to give readers the real skinny, I'll be the adult
in the room:

OSX/HellRTS.D or HellRaiser is a trojan. This type of infection does not
use any technical weakness in the OS, instead relying on duping the
user to run it. Again, this is NOT a weakness in the security of Mac OS
X - to put it another way; don't expect a "patch" for this. What users
should do, be careful about the software you install on Mac OS X (or
indeed any computer) especially software that requires your admin
password. Especially be careful of pirated software as this carries a
huge risk of being infected. As always keep your Mac fully patched.
Infections like this rely on "social engineering" (tricking the user) so if
something sounds too good to be true... it probably is.

OK, carry on.
0 Votes
+ -
Agreed- how do you get rid of it?
howardgr 19th Apr 2010
Please, if you're going to write about something like this, make some
suggestions as to how to keep from being infected, what to look for on
your machine, what tools might or will remove it. Facts, please.
0 Votes
+ -
OSX pwnd!
AzuMao 16th Apr 2010
Just kidding. If you look at the article you'll see the most common AV for OSX (VirusBarrier) blocks this, and that it's not even being distributed in the wild, unless you count harmless source text.
posterior about this BS propaganda "Zero Virus in the wild", and claim a virus requires no user intervention to propagate. Thus no malware exists for the Mac. Right.

Malware, trojans are there and exploit vulnerabilities, not necessarily 'software engineering' but 'social engineering' requiring whatever sits between the chair and keyboard, to click something and be duped.

Unless you've been born out of the Apple assembly line, you are like everybody else, actually even more vulnerable (and gullible) since you don't even believe in the possibility of being tricked.

Yeah, you Apple users are impervious and invincible... Or so you are led to believe.

Security through awareness, not faith.

That is your collective weakness. You can thank Apple's brainwashing for that.

Stay in denial all you want. Who really cares? Certainly not Apple. They only care about profiting from their herds of sheeps and laughing all the way to the bank.

Malware is directly proportional to success... Congratulations.

Blue or Red pill?

~~~~~~~~~~~
The truth is incontrovertible, malice may attack it, ignorance may deride it, but in the end; there it is.
~ Winston Churchill
If you read the body of my post instead of just the subject you would get my
point. OSX wasn't really pwnd by this; people just love the idea of their favorite
OS (Windows) not being worse than others (like OSX and Linux). I was just setting
the facts straight before said people jumped in with "HAHA APPLE FAILZOR" spam.

0 Votes
+ -
No... OSX wasn't owned by this...
ShadowGIATL 17th Apr 2010
but what it does prove, is that despite the Apple fanboys constant comments on how viruses and worms CANNOT affect Macs, they indeed can.

Are they running rampant in the wild? Not yet. But they could be if someone put forth the effort. So for all the Mac fans, just be glad no one cares enough to put out that effort.

The more you brag, the more likely one day someone will serve it to you.

Me personally, I think OSX is a decent OS. Not my favorite due to it being locked down to certain hardware which limits my ability to customize it how I want (or build my own, as I like to do). This reason is what keeps me from being an OSX owner.
0 Votes
+ -
They do very often.
ShadowGIATL 17th Apr 2010
You sir, however, feel the need to argue minute points where an argument wasn't needed.

I stated facts, and then you followed up with the usual "no, Mac is better than everything", and I just merely stated my point that all systems can be compromised.

And for the record, Macs not only can be infected, but they have been with various other threats. Is it very common? Not so far. But that really isn't how some Mac fanboy's want to tell it, and in doing so, they are only being dishonest to themselves.

Moving on...
  • Flagged
..I am trying to discuss here. If you don't find that significant, go away.
  • Flagged
0 Votes
+ -
... since OS X was released?
0 Votes
+ -
@vulpine
ShadowGIATL 20th Apr 2010
I'm not to sure, as Macs are rare in my area, I don't really keep up with it much.

That said, there have been infections here and there, but considering Macs make up a much smaller percent of install base overall compared to Windows, the percent of infections will be considerably lower if for no other reason.

Statistics are a tricky thing, and rather than get bogged down in the who has more peeing contest, I prefer to live in the real world where infections might not be common, but are still a possibility.

You must remember, some of the first viruses were written for Unix back in the day, so by that token, it is not invulnerable. More secure maybe, but not perfect.
OS (all flavors of Windows, including 7) 'automagically' just by running it connected to the internet (mostly by IE). Windows loses. All other OS's require user action BEYOND clicking a link. MS OS's only require a visit to a site.

Windows Loses. OSX Wins. Bye bye now Shadow of a person!
0 Votes
+ -
pwn2own
rtk 19th Apr 2010
OS X pwnd via drive by exploit, "automagically".

OS X loses.
  • Flagged
And no, "nobody was interested in pwning it" when they'd've gotten just as much money for pwning it as any of the others just doesn't fly.
0 Votes
+ -
@azuMao
rtk 19th Apr 2010
Linux wasn't available to pwn, since it was dumped from this year's contest for reasons clearly other than your conspiracy theory posted elsewhere.

EOD.
  • Flagged
0 Votes
+ -
....
Badgered 19th Apr 2010
Windows Loses. OSX Wins. Bye bye now Shadow of a person

uh huh....

http://www.tomshardware.com/news/security-hacker-os-x-windows-7-flash,10205.html
  • Flagged
0 Votes
+ -
OS (all flavors of Windows, including 7) 'automagically' just by running it connected to the internet (mostly by IE). Windows loses. All other OS's require user action BEYOND clicking a link. MS OS's only require a visit to a site.

Number one, Windows has more userbase than anyother OS.. so by that virtue they won a long time ago, and so far maintaining that lead.

Two, you claim all other OS require user action to become infected, but this has already been proven wrong in the past, and the tired factless arguement by you and other propogandist is getting very old.

Windows Loses. OSX Wins. Bye bye now Shadow of a person!

If OSX was such a winner, then why is it not more popular?

In my opinion, all OS's appeal to certain people, and to each their own. You are not the vioce of the people, and frankly, no one really cares what your opinion is due to you severe lack of neutrality.
  • Flagged
0 Votes
+ -
"Number one, Windows has more userbase than anyother OS.. so by
that virtue they won a long time ago, and so far maintaining that
lead."

Essentially incorrect, since Microsoft "cheated" and tied MSDos to IBM's
PC platform, then licensed the OS to anyone who wanted to build to
that platform. IBM believed that by copyrighting the bios and keeping
close hold on the patents, that no one could encroach on their design,
but through industrial espionage and reverse engineering, IBM's hold
shattered and the market--and enterprises--were flooded by IBM
clones and compatibles. IBM's name made Microsoft dominant--until
Microsoft made IBM's name worthless in the desktop market. That's
how Windows took the lead, and why Windows still holds it.
However, that dominance is beginning to slip.

"If OSX was such a winner, then why is it not more popular?"
Maybe you should look at the numbers. OS X is 3x more popular today
than it was in January of 09. Win7 may be taking most of the Windows
holdouts from XP and Vista, but they're not taking all of them. In the
US, OS X now holds 13.13% of the OS market and world-wide holds
over 6%. Reference http://gs.statcounter.com/#os-US-daily-
20080701-20100321

"In my opinion, all OS's appeal to certain people, and to each their
own. You are not the vioce of the people, and frankly, no one really
cares what your opinion is due to you severe lack of neutrality."

In this you are at least half right, though your own bias is no better.
Chevrolet/GM was the #1 automaker in the country and in the world for
decades. Where do they stand now?

Just because you sell the most doesn't necessarily make you the best.
However, the best will eventually make itself felt, if not in numbers,
then in influence that they have over the product's market. What one
brand has been massively influential in the automotive market for the
last 30 years or more? Germany's Mercedes Benz. What one brand has
been massively influential in the computer market for the last 30 years?
Apple. Neither of them own majority share in their particular fields of
endeavor--with the exception of the iPod for now--yet the changes
they make to their products influence the design of similar products for
years to come.
0 Votes
+ -
Popular= 'Winner'?
TCollinsG3 19th Apr 2010
Chevys and Fords are popular in the United States and vastly outnumber
either Lexus or BMW. But given the opportunity, would you rather have a
Chevy or Ford, or a Lexus or BMW? By your failed line of reasoning, the
correct response would be "Chevy or Ford." Now Lexus and BMW have to
continue to lead in quality and craftsmanship to perpetuate this analogy,
as does Apple, but the analogy still currently rings true. Being popular never has been the most reliable gauge of being the best, and Apple has
shown that, even in the face of not being the most popular, it still knows
how to be the most prosperous and profitable computer company in the
world.
0 Votes
+ -
@vulpine
ShadowGIATL 20th Apr 2010
"Number one, Windows has more userbase than anyother OS.. so by that virtue they won a long time ago, and so far maintaining that
lead."

Essentially incorrect, since Microsoft "cheated" and tied MSDos to IBM's
PC platform, then licensed the OS to anyone who wanted to build to
that platform.


How does that make Windows less popular? IBM and Microsoft were partners in a time where the PC had yet to be defined. Before them, is was a scatter shot of different platforms, of which none were compatible. File sharing was nearly impossible. Given that, it was inevitible that the platforms would have to merge, and confrom to some standards to become more interworkable.

"If OSX was such a winner, then why is it not more popular?"

Maybe you should look at the numbers. OS X is 3x more popular today than it was in January of 09. Win7 may be taking most of the Windows holdouts from XP and Vista, but they're not taking all of them. In the
US, OS X now holds 13.13% of the OS market and world-wide holds over 6%. Reference http://gs.statcounter.com/#os-US-daily-
20080701-20100321


Being more popular than it was last year doens't make it more popular than Windows. Your whole arguement here misses the point. Also, different sites cite different numbers, and most tend to agree it's less than 13%. Either way, 13% is far from more than 90%, or even 85% if you want to take away as much as you can from Windows. The problem with the numbers is that no one really knows how many are return users of either platform, or how many are new users. Given that, the numbers are extremely unscientific, and still fail to address my point at any rate.

"In my opinion, all OS's appeal to certain people, and to each their
own. You are not the vioce of the people, and frankly, no one really
cares what your opinion is due to you severe lack of neutrality."

In this you are at least half right, though your own bias is no better.
Chevrolet/GM was the #1 automaker in the country and in the world for
decades. Where do they stand now?


Again, this fails to directly address my point. As my point was a personal opinion, and stated that all people are different and will like different things, your citing that some other company was #1 and not anymore has no relationship to my comment.

Just because you sell the most doesn't necessarily make you the best.

I never said winner=best. There are many things that have won out over other things that aren't best. Look on the shelves at most the stores. Almost everything is made in china, and most of that stuff is pure crap. Why did it end up on the shelf and other, better quality stuff fall to the side, and in some cases the companies gone bankrupt? Because the make it cheaper, and in todays world, the majority feel everything should be cheaper. Does it make it right? No, but it does make china the winner. Like it, or not.

My statements are not about what is best, and what is crap. It was meant to state that no matter how bad some people might hate a company for whatever reason, stating that one company is better is subjective. You might like quality, but someone else might prefer price. Point is, what you like isn't always what everyone else likes, and if the majority of people likes one company, or product, than for all intents and purposes, they are the winner.

Frankly, after seeing the latest rounds of user and developer agreements Apple's been throughing around, I'd be leaning more towards Linux then Mac. I find Linux to be much more flexible as far as hardware, and I like my freedom of choice. But again, that is just my opinion.
0 Votes
+ -
@TScollins
ShadowGIATL 20th Apr 2010
Chevys and Fords are popular in the United States and vastly outnumber either Lexus or BMW. But given the opportunity, would you rather have a Chevy or Ford, or a Lexus or BMW? By your failed line of reasoning, the
correct response would be "Chevy or Ford."

And you are correct. I have owned both a Ford, and a Porsche, But I would rather have the Ford. They are cheaper to own, and have proven to have a respectible meantime between failures as compared to german cars from my experience. And so my point stands, that from each individuals point of view, what you like might not be what they like.

Also, considering Lexus is just an overpriced Toyota, and given their track record here lately, I wouldn't drive one for someone else.

Now Lexus and BMW have to continue to lead in quality and craftsmanship to perpetuate this analogy, as does Apple, but the analogy still currently rings true.

However, Apple has fallen in its ratings for quality (although I contend that no one has a true measure of this factor for various different reasons), and now most of their hardware is made in the same factories in china as most PC vendors. This fact would challenge the thought pattern that because it's Apple, its better quality.

Being popular never has been the most reliable gauge of being the best, and Apple has
shown that, even in the face of not being the most popular, it still knows how to be the most prosperous and profitable computer company in the world.


Last I heard, they were number three, not number one. Maybe a small lapse on your part, but still a misrepersentation of facts.
0 Votes
+ -
RE: New Mac OS X malware variant spotted
efsane Updated - 9th Apr 2011
Great!!! thanks for sharing this information to us!
sesli sohbet sesli chat

Join the conversation!

Formatting +
BB Codes - Note: HTML is not supported in forums
  • [b] Bold [/b]
  • [i] Italic [/i]
  • [u] Underline [/u]
  • [s] Strikethrough [/s]
  • [q] "Quote" [/q]
  • [ol][*] 1. Ordered List [/ol]
  • [ul][*] · Unordered List [/ul]
  • [pre] Preformat [/pre]
  • [quote] "Blockquote" [/quote]
ie8 fix
Click Here
ie8 fix

The best of ZDNet, delivered

ZDNet Newsletters

Get the best of ZDNet delivered straight to your inbox

Facebook Activity

White Papers, Webcasts, & Resources
ie8 fix
ie8 fix